Struct WindowsThread 

pub struct WindowsThread<'a, Driver>
where
    Driver: VmiRead,
    Driver::Architecture: ArchAdapter<Driver>,
{ /* private fields */ }

A Windows thread.

A thread in Windows is represented by the _ETHREAD structure, which contains metadata about its execution state, context, and scheduling.

Implementation Details

Corresponds to _ETHREAD.

Implementations

impl<'a, Driver> WindowsThread<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

pub fn new(vmi: VmiState<'a, WindowsOs<Driver>>, thread: ThreadObject) -> Self

Creates a new Windows thread.

pub fn process(&self) -> Result<WindowsProcess<'a, Driver>, VmiError>

Returns the process object associated with the thread.

Implementation Details

Corresponds to _KTHREAD.Process.

pub fn apc_state_index(&self) -> Result<u8, VmiError>

Returns the index into KTHREAD.ApcStatePointer selecting the thread’s currently-active APC environment.

• 0 (OriginalApcEnvironment): thread is running in its original process.

• 1 (AttachedApcEnvironment): thread is temporarily attached to a foreign process via KeStackAttachProcess / KeAttachProcess.

  The original KTHREAD.ApcState is preserved in KTHREAD.SavedApcState.

Implementation Details

Corresponds to _KTHREAD.ApcStateIndex.

pub fn is_attached(&self) -> Result<bool, VmiError>

Checks if the thread is currently attached to foreign process context.

Implementation Details

Corresponds to _KTHREAD.ApcStateIndex != 0.

pub fn current_process(&self) -> Result<WindowsProcess<'a, Driver>, VmiError>

Returns the process whose address space the thread is currently executing in.

Implementation Details

Corresponds to _KTHREAD.ApcState.Process.

pub fn saved_process( &self, ) -> Result<Option<WindowsProcess<'a, Driver>>, VmiError>

Returns the thread’s saved home process, or NULL if the thread is not attached.

Implementation Details

Corresponds to _KTHREAD.SavedApcState.Process.

pub fn impersonation_token( &self, ) -> Result<Option<WindowsToken<'a, Driver>>, VmiError>

Returns the thread’s impersonation token, or None when the thread is not currently impersonating.

Implementation Details

Corresponds to _ETHREAD.ClientSecurity.ImpersonationToken, gated on _ETHREAD.ActiveImpersonationInfo.

pub fn next_processor(&self) -> Result<VcpuId, VmiError>

Returns the ID of the processor the thread is bound to.

For a Running thread this is the CPU currently executing it. For a Ready or Standby thread this is the CPU the scheduler has selected for its next run.

Implementation Details

Corresponds to _KTHREAD.NextProcessor.

pub fn alertable(&self) -> Result<bool, VmiError>

Returns whether the thread is currently alertable.

Notes

Usually only trustworthy when _KTHREAD.State == Waiting.

Implementation Details

Corresponds to _KTHREAD.Alertable.

pub fn wait_mode(&self) -> Result<WindowsProcessorMode, VmiError>

Returns the thread’s wait mode.

Notes

Usually only trustworthy when _KTHREAD.State == Waiting.

Implementation Details

Corresponds to _KTHREAD.WaitMode.

pub fn wait_reason(&self) -> Result<WindowsThreadWaitReason, VmiError>

Returns the thread’s wait reason.

Notes

Usually only trustworthy when _KTHREAD.State == Waiting.

Implementation Details

Corresponds to _KTHREAD.WaitReason.

pub fn teb(&self) -> Result<Option<WindowsTeb<'a, Driver>>, VmiError>

Returns the thread’s TEB.

Implementation Details

Corresponds to _KTHREAD.Teb for the native TEB, and Teb64 + ROUND_TO_PAGES(sizeof(TEB)) for the WoW64 TEB.

pub fn native_teb(&self) -> Result<Option<WindowsTeb<'a, Driver>>, VmiError>

Returns the thread’s native TEB.

Implementation Details

Corresponds to _KTHREAD.Teb.

pub fn trap_frame( &self, ) -> Result<Option<WindowsTrapFrame<'a, Driver>>, VmiError>

Returns the thread’s trap frame.

Points to the most recent user-to-kernel transition trap frame for the thread. It records the user-mode register state that was captured when the thread entered the kernel via a syscall, interrupt, or exception.

Can be NULL when the thread is executing purely in kernel mode and has not entered via a user-mode trap.

Implementation Details

Corresponds to _KTHREAD.TrapFrame.

pub fn state(&self) -> Result<WindowsThreadState, VmiError>

Returns the thread’s scheduling state.

Implementation Details

Corresponds to _KTHREAD.State.

pub fn kernel_stack(&self) -> Result<Va, VmiError>

Returns the saved kernel stack pointer for this thread.

For threads that are not currently running, this is the stack pointer value saved during the last context switch (KiSwapContext).

Implementation Details

Corresponds to _KTHREAD.KernelStack.

Trait Implementations

impl<'a, Driver> From<WindowsThread<'a, Driver>> for WindowsObject<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn from(value: WindowsThread<'a, Driver>) -> Self

Converts to this type from the input type.

impl<'a, Driver> FromWindowsObject<'a, Driver> for WindowsThread<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn from_object( object: WindowsObject<'a, Driver>, ) -> Result<Option<Self>, VmiError>

Attempts to convert a WindowsObject into a specific object type.

impl<'a, Driver> VmiOsThread<'a, Driver> for WindowsThread<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn id(&self) -> Result<ThreadId, VmiError>

Returns the thread ID.

Implementation Details

Corresponds to _ETHREAD.Cid.UniqueThread.

fn object(&self) -> Result<ThreadObject, VmiError>

Returns the thread object.

type Os = WindowsOs<Driver>

The VMI OS type.

impl<Driver> VmiVa for WindowsThread<'_, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn va(&self) -> Va

Returns the virtual address.